ARAC Minutes - 19 December 2023

Present

Chair’s welcome, apologies and declarations

The Chair welcomed everyone present to the meeting.  ARAC noted apologies from Louisa Yule (LY) Senior Audit Manager - Audit Scotland.

There were no declarations of interest.

Minutes of the previous meeting, matters arising & audit log

ARAC considered and approved the minutes from its meeting on 18 September 2023 as an accurate record of the meeting. 

ARAC considered the matters arising and audit action logs.

IM confirmed that following consideration of the assurance map by ARAC in September, he will take account of feedback and bring it back to ARAC again in June 2024. He highlighted that this will coincide with the outcome of the planned review of SHR’s risk management strategy and also implementation of a new organisational strategy from April 2024.  IM reported that JM has provide him with useful information to inform development. 

ARAC thanked JM for the information on assurance mapping approaches taken by other clients.  It noted the ongoing work as well as SHR’s retention policy and schedule.  ARAC noted the matters arising items covered by the meeting.

Internal Audit Update

JM presented an update on Internal Audit work.  He reported that they are on track to complete the audit work programme with SHR, with work on the review of SHR’s Regulatory Framework review planned for January – March 2024.  He highlighted that the Directorate has completed a  horizon scan for all clients, which it will shortly discuss with SHR.

JM reported that he will be stepping back due to retirement in April 2024 and replaced by Louise Carmichael and that GG will be rotated to another client with Paul Marshall taking over and that both hope to attend SHR ARAC in March 2024.  ARAC noted the changes and discussed continuity, noted staffing resources challenges and work that SHR will need to do to bring the new staff team up to speed with SHR.

ARAC also discussed increased audit fee proposals and related communications with SHR, noting the lack of prior consultation. MC updated ARAC on discussions at the Scottish Delivery Bodies meeting and his concerns around the impact on SHR resources and potential for further creep in recharges from Scottish Government to public bodies.  MC highlighted that, at its establishment, SHR was designed to receive services from the Scottish Government in perpetuity and these had never been embedded in its structure or funding model. 

JM explained how Internal Audit functions are more in demand than ever and the unprecedented resource challenges it is facing.  He also explained that newer public bodies have had charging embedded from the outset.  ARAC noted that SHR’s arrangements may have been set out in a historical Framework Agreement with Scottish Government when the function was separated from Communities Scotland. 

ARAC noted that MC will meet with the Head of Internal Audit early in 2024 and agreed to wait until after this meeting before agreeing any further actions. It asked JM to provide further information on how this is approached with the full range of Internal Audit clients.

ARAC noted that Internal Audit had become involved in discussions relating to financial transformation and it welcomed the intervention to assist with proposals around bank accounts for public bodies. 

ARAC discussed the Scottish Government’s shared services transformation project noting that the red project status and that both the financial and HR aspects are now due to go live in April 2024. IM reported that even a successful transition will result in significant disruption to SHR and other organisations.  AM explained some ongoing issues around user testing.  IM also explained that the current underpinning systems are old and not joined up and the transformation to completely new systems should in time delivery improvements.  ARAC noted that the lack of certainty around implementation dates and how this impacts SHR’s work planning.  

ARAC noted the updates and thanked JM and his team.

Actions: JM to provide information on audit fee arrangements with other clients. 

Risk Report and risk management review

IM presented the risk register to ARAC. He highlighted the increase likelihood score in relation to shared services received from the Scottish Government that was recently increased by Management Team.  ARAC consider the register a discussed:

• recent media coverage and MSP interest in regulatory casework with one RSL; and
• systemic risks in the sector, noting how that translates into SHR’s corporate register under both the effective Regulatory Framework risk and the reputational risk.

IM also reported on recent discussions at the SHR Board’s workshop around plans for reviewing the corporate risk management strategy.  ARAC discussed visibility of risk mitigation actions and involvement of staff - agreeing this was important. 

JM reported on correspondence within Scottish Government about supplementary risks and agreed to share information on this with IM. 

ARAC noted the risk register asking IM to feedback on its discussions to Management Team.  It also noted next steps around the strategy review and plans for it to focus on this in March to allow for proposals to the March 2024 SHR Board meeting.

Action:

• IM to update Management Team on ARAC risk register discussions.
• JM to share information on supplementary risk asks with IM.

ARAC Self Assessment

SW introduced the periodic self assessment to ARAC. She explained how ARAC alternated annually between a survey and discussion approach.  ARAC considered the discussion questions that ARAC had previously agreed to focus on.  It discussed:

• availability of ARAC meeting and information papers to the whole of SHR Board for reference agreeing to explore this;
• the working relationship between ARAC and the auditors, agreeing that this was working well and general feedback from auditors from onsite phases of work was positive. It asked IM to explore this question with the audit team as part of the forthcoming audit planning meeting;
• risk management - agreeing this was working well;
• responsiveness to audit recommendations – agreeing that the audit log it reviews at each meeting is important and works well;
• SHR governance and fraud oversight, agreeing it was comfortable with current arrangements;
• meeting arrangements agreeing that this worked well; and
• if ARAC is fulfilling its duties and member understanding. It agreed that this was all in place.

ARAC also discussed cyber resilience.  It noted the review work internal audit has done for SHR.  IM reported that he, LP, another SHR Board member and SHR’s Assistant Director of Digital are attending some cyber security training in the coming months and an update to the Public Sector Resilience Framework is also expected.  IM explained that SHR will use all this to inform next steps.   ARAC noted that in the instance of an attack SHR is covered by the Crown rather than specific cyber insurance and that it would discuss any additional spend incurred with the Scottish Government.  It agreed it was important to have cyber security on the agenda regularly. 

Action: IM to:

• explore making ARAC meeting and information papers available to all of SHR’s Board for reference;
• gather auditor feedback on relationships at a forthcoming planning meeting; and
• update ARAC on cyber security following training and publication of the Public Sector Resilience Framework.

Terms of Reference review

IM presented a review of ARAC’s terms of reference.  He explained that the Audit Committee handbook recommends annual reviews.  IM reported that proposed updates are minor adjustments around arrangement for ARAC meeting minutes to better reflect current practice. 

ARAC supported the proposals and in addition asked for a minor correction in the first paragraph.   ARAC agreed to propose the updated Terms of Reference to SHR’s Board  for approval in February 2024

Actions: IM to update the terms of reference as agreed by ARAC and propose it to SHR Board for approval in February 2024. 

Agenda Planner, AOB, New matters & DONM

ARAC considered the agenda planner. SW highlighted that the external audit plan will be presented to the Committee in March 2024.  Internal Audit explained that it will complete work plans during quarter four and report to the following ARAC meeting. 

ARAC noted the updates and forward agenda planner. 

Private session

ARAC met the auditors in private.